audio-gen
Warn
Audited by Socket on Oct 21, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the stated purpose is plausible, but the skill relies on a transitive third-party SAG dependency with mismatched publisher provenance and forwards ElevenLabs credentials to that helper. Data flow is broadly on-purpose, yet install trust and credential-forwarding are high-risk relative to what a direct official API integration would require.
Confidence: 84%Severity: 79%
Audit Metadata